Illinois AI safety law targets models with massive compute — new reporting on bio, cyber risks

For AI researchers and engineers, the Illinois bill translates high-level safety principles into concrete reporting duties. Teams building models trained with massive compute will now face mandatory submissions to state authorities detailing whether their systems could advise a malicious actor on synthesizing a bioweapon or penetrating a power grid. This makes red-teaming and capability forecasting not just good practice, but a legal prerequisite, and it may drive a new wave of investment in model evaluation tooling.

On July 6, 2026, Illinois Governor J.B. Pritzker signed the Artificial Intelligence Safety Measures Act into law, marking a pivotal moment in U.S. AI regulation. Senate Bill 315, modeled directly on California’s SB-53 and New York’s Responsible AI Safety and Education Act, creates the nation’s third major state-level framework targeting the most powerful AI systems. The bill applies to models that generate more than $500 million in annual revenue and are trained using what the law describes as massive computing power—effectively capturing frontier models developed by the world’s largest technology companies. At its core, the law mandates new transparency and accountability standards: developers must evaluate and report on the potential for their models to enable large-scale harms, including assistance in creating chemical, biological, or nuclear weapons, or enabling sophisticated cyberattacks. This focus on catastrophic risk management signals a broadening of regulatory attention beyond data privacy and bias into national security dimensions of AI.

“

The bill applies to models that generate more than $500 million in annual revenue and are trained using what the law describes as massive computing power—effectively capturing frontier models developed by the world’s largest technology companies.

The legislative context is critical. Congress has repeatedly failed to pass comprehensive AI safety legislation, leaving a vacuum that states have been filling with increasing urgency. Pritzker’s signing ceremony underscored this dynamic, as he explicitly criticized federal inaction: “Congress and the president ought to be passing similar legislation, but they’ve so far been unwilling, because many are captive to special interests that profit from the industry having no regulation.” With California and New York having enacted similar laws in late 2025, Illinois now joins a coalition whose combined AI market share—estimated by lawmakers at roughly 40% of the U.S. total—effectively establishes a de facto national standard. For AI companies, a single set of overlapping compliance requirements across these three states is far more feasible than a 50-state patchwork, but it also raises the stakes: non-compliance in one can cascade into market-wide reputational and legal consequences.

The bill’s $500 million revenue threshold is a critical design choice. It spares the vast majority of AI developers, particularly small startups and non-AI companies using existing tools, from direct obligations. This reflects a deliberate balance—addressing the most powerful models that pose the greatest risk while avoiding stifling innovation across the broader ecosystem. However, it raises definitional questions: revenue from exactly which AI activities counts? And as models grow, a company might cross the threshold unexpectedly, triggering costly reporting protocols. The law’s dependence on a computing power standard—a productivity metric that can change rapidly—adds further complexity and may need ongoing calibration.

The immediate impact on major AI companies is tangible. Entities like Google DeepMind, Anthropic, OpenAI, Meta, and Microsoft operate models likely exceeding the revenue and compute thresholds. They now face mandatory reporting to the Illinois Department of Commerce and Economic Opportunity—or its designated agency—with potential penalties for non-compliance. While the specifics of reporting are to be determined through rulemaking, the required focus on catastrophic use cases means red-teaming and safety evaluations must go beyond current voluntary norms. This could accelerate the maturation of AI safety science and the professionalization of model assessment, but it also introduces legal liability if reports are deemed misleading or incomplete. Enforcement mechanisms remain to be detailed, but the threat of civil penalties and possible injunctions will push companies to invest heavily in compliance infrastructure.